Topics in this domain
- Security Governance and Roles
- Data Classification and Ownership
- Security Policies
- Privacy Principles and GDPR
- Identity Management
- Authentication Factors
- Biometrics
- Access Models: DAC, MAC, RBAC
- Logical and Privileged Access
- Cryptography Basics
- Symmetric Encryption
- Asymmetric Encryption
- Hashing and Integrity
- Digital Signatures
- PKI and Certificates
- Firewalls
- IDS/IPS
- VPN, SSL/TLS, IPsec
- Wireless Security
- Endpoint and Mobile (BYOD)
- Cloud and Virtualization Security
- Physical Access Controls
- Environmental Controls: Fire, Power, HVAC
- Social Engineering
- Malware
- Network Attacks: DoS, Spoofing, Sniffing
- Application Attacks: SQLi, XSS
- Vulnerability Management and Pen Testing
- Incident Response
- Digital Forensics and Chain of Custody
- Security Awareness Training
- Logging, SIEM, and Auditing Security
Security Governance and Roles
Who’s in charge of security?
In a block of flats, the owners’ committee decides how secure the building should be and pays for it. The caretaker fits the locks. Each resident decides who gets a key to their own flat. And everyone is expected to shut the main door behind them.
Information security works the same way. Information security governance is the board and senior management setting direction for security, making sure its objectives are met, managing risk sensibly and using resources responsibly. It’s part of corporate governance, not an IT side project.
- The board is accountable and should understand the significant security risks.
- Senior management approves the security strategy and policy, provides resources, and visibly supports the programme.
- A security steering committee with people from the business, IT, legal, HR and risk keeps security aligned with what the business needs.
When the exam asks for the most important factor in a successful security programme, the answer is almost always senior management commitment and support.
The roles
| Role | Responsibility |
|---|---|
| CISO / information security manager | Builds and runs the security programme; reports risk to senior management |
| Data / information owner | A business manager who classifies data, approves access and accepts residual risk |
| Process owner | Owns a business process and its controls |
| Data custodian | Implements protection on the owner’s behalf: storage, backup, access configuration |
| Security administrator | Sets up access and user accounts as approved; doesn’t decide who gets access |
| System owner | Responsible for a system’s operation and security |
| Users | Follow policy, protect their credentials, report incidents |
| IS auditor | Provides independent assurance over security |
Security is everyone’s responsibility, but accountability still has to be assigned to someone specific.
Where the CISO reports
The CISO needs enough authority and independence to say “no” and be heard. Reporting to the CIO can create a conflict, because security may be traded off against IT delivery deadlines. Reporting to the CEO, COO, chief risk officer or a similar executive is often recommended.
Example. The CISO reports to the head of IT infrastructure. A request to delay a critical patch for a business launch is decided by the infrastructure head alone, and the CISO’s concerns never reach senior management. The auditor recommends a reporting line that lets security risks be escalated independently.
What security protects
- Confidentiality: only the right people can see it
- Integrity: nobody changes it without authority, or by accident
- Availability: it’s there when authorised people need it
- Accountability: actions can be traced to a person
- Non-repudiation: nobody can deny what they did
A security programme includes strategy and policy, risk management, controls, awareness and training, incident management, monitoring and metrics, and continuous improvement. Frameworks such as ISO 27001, NIST CSF and COBIT give it structure.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Most important factor for a successful security program | Senior management commitment |
| Who classifies data and approves access | The data owner |
| Who implements protection decided by owners | Data custodian / security administrator |
| Concern with CISO reporting to the CIO | Conflict of interest; reduced independence |
| Who is accountable for information security | The board / senior management |
In short
- Information security governance is part of corporate governance: the board is accountable, senior management sets direction and resources.
- The most important success factor for an information security program is senior management commitment and support.
- The CISO leads the security program and should report at a level that provides independence from IT operations.
- Data owners classify data and approve access; data custodians implement protection; users follow policy.
- A security steering committee with business representation aligns security with business needs.
- Security objectives are confidentiality, integrity and availability, plus accountability and non-repudiation.
Exam traps
- The CISO reporting to the CIO can create a conflict, since security may be traded off against IT delivery.
- Data owners are business managers, not IT staff.
- Security administrators implement access as approved by owners; they don't decide who gets access.
- Security is everyone's responsibility, but accountability must be assigned.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The roles
Where the CISO reports
What security protects